« Volver al listado

CVE-2020-36382

Estado: ModificadaAlta (7.5)—

OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openvpn — Openvpn Access Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-36382",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@openvpn.net",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "OpenVPN Access Server",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.3 to 2.8.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-04T11:15:07.790",
  "references": [
    {
      "url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://openvpn.net/vpn-server-resources/release-notes/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@openvpn.net"
    },
    {
      "url": "https://openvpn.net/security-advisory/access-server-security-update-cve-2020-15077-cve-2020-36382/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://openvpn.net/vpn-server-resources/release-notes/",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@openvpn.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service."
    },
    {
      "lang": "es",
      "value": "OpenVPN Access Server versiones 2.7.3 a 2.8.7, permite a atacantes remotos desencadenar una aserción durante la fase de autenticación del usuario por medio de datos de token de autenticación incorrectos en una fase temprana de la autenticación del usuario, resultando en una denegación de servicio"
    }
  ],
  "lastModified": "2026-06-17T03:15:22.547",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openvpn:openvpn_access_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CCB7D6A-6B44-48D0-B392-56292BA7D35C",
              "versionEndIncluding": "2.8.7",
              "versionStartIncluding": "2.7.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@openvpn.net"
}